GHSA-w65j-cmqc-37p2
JULI logging component in Apache Tomcat does not restrict certain permissions for web applications
At a glance
- Published
- Updated
- CVE
- CVE-2007-5342
Description
The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the `org.apache.juli.FileHandler` handler.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.tomcat:tomcat-juli | introduced 5.5.9, last affected 5.5.25 |
| Maven · org.apache.tomcat:tomcat-juli | introduced 6.0.0, last affected 6.0.15 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2007-5342 ADVISORY
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39201 WEB
- https://github.com/apache/tomcat/tree/main/java/org/apache/juli PACKAGE
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E WEB
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10417 WEB
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html WEB
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html WEB
- http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html WEB
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html WEB
- http://marc.info/?l=bugtraq&m=139344343412337&w=2 WEB
- http://security.gentoo.org/glsa/glsa-200804-10.xml WEB
- http://securityreason.com/securityalert/3485 WEB
- http://support.apple.com/kb/HT3216 WEB
- http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm WEB
- http://svn.apache.org/viewvc?view=rev&revision=606594 WEB
- http://tomcat.apache.org/security-5.html WEB
- http://tomcat.apache.org/security-6.html WEB
- http://www.debian.org/security/2008/dsa-1447 WEB
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:188 WEB
- http://www.redhat.com/support/errata/RHSA-2008-0042.html WEB
- http://www.redhat.com/support/errata/RHSA-2008-0195.html WEB
- http://www.redhat.com/support/errata/RHSA-2008-0831.html WEB
- http://www.redhat.com/support/errata/RHSA-2008-0832.html WEB
- http://www.redhat.com/support/errata/RHSA-2008-0833.html WEB
- http://www.redhat.com/support/errata/RHSA-2008-0834.html WEB
- http://www.redhat.com/support/errata/RHSA-2008-0862.html WEB
- http://www.securityfocus.com/archive/1/485481/100/0/threaded WEB
- http://www.securityfocus.com/archive/1/507985/100/0/threaded WEB
- http://www.securityfocus.com/bid/27006 WEB
- http://www.securityfocus.com/bid/31681 WEB
- http://www.vmware.com/security/advisories/VMSA-2008-0010.html WEB
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |